INNER CODE UNIT · Python
SecurityHeadersMiddleware
flukelaster/ai-trading-agent · backend/app/main.py:400
class SecurityHeadersMiddleware(BaseHTTPMiddleware):
async def dispatch(self, request: Request, call_next):
response = await call_next(request)
response.headers["X-Content-Type-Options"] = "nosniff"
response.headers["X-Frame-Options"] = "DENY"
response.headers["X-XSS-Protection"] = "1; mode=block"
response.headers["Referrer-Policy"] = "strict-origin-when-cross-origin"
response.headers["Strict-Transport-Security"] = "max-age=31536000; includeSubDomains"
response.headers["Permissions-Policy"] = "geolocation=(), microphone=(), camera=()"
# CSP: API serves JSON in prod (docs gated by ENABLE_API_DOCS). Drop
# both script + style 'unsafe-inline'. If a future endpoint serves an
# HTML error page that needs inline style, switch that endpoint to
# JSON or use a per-response nonce instead of broadening CSP again.
response.headers["Content-Security-Policy"] = (
"default-src 'self'; "
"script-src 'self'; "
"style-src 'self'; "
"img-src 'self' data: blob:; "